mailing list archives
Re: Running tshark on large pcap files
From: Christopher Maynard <Christopher.Maynard () gtech com>
Date: Wed, 12 Jun 2013 16:42:04 +0000 (UTC)
Evan Huus <eapache () > writes:
And it also doesn't seem like I can split up the files with editcap.
Whenever I tried to do that with the large pcap files, I got empty output
files (24 bytes) instead. I'm not sure if it was due to the large file size.
That's odd. If you can reproduce consistently (and perhaps with a
smaller capture) please file a bug.
This might be bug 2868: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868
Did you try passing, "-F libpcap" to editcap?
Sent via: Wireshark-users mailing list <wireshark-users () wireshark org>
mailto:wireshark-users-request () wireshark org?subject=unsubscribe